Provably Secure Experimental Quantum Bit-String Generation 
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Coin tossing is a cryptographic task in which two parties who do not trust each other aim to 
generate a common random bit. Using classical communication this is impossible, but non trivial 
coin tossing is possible using quantum communication. Here we consider the case when the parties 
do not want to toss a single coin, but many. This is called bit string generation. We report the 
experimental generation of strings of coins which are provably more random than achievable using 
classical communication. The experiment is based on the "plug and play" scheme developed for 
quantum cryptography, and therefore well suited for long distance quantum communication. 

PACS numbers: 



Coin tossing is a cryptographic task, introduced by 
Blum 0, in which two parties who do not trust one 
another aim to generate a common random bit. Coin 
tossing is an important primitive that can be used in the 
design of other two-party protocols such as mental poker 
and mail certification and it could even form the basis 
of a scheme for bit commitment that is computationally 
secure against quantum attacks 0] ■ Classically, coin toss- 
ing is impossible without computational assumptions: at 
least one of the parties can in principle always cheat and 
fix the outcome. Using quantum communication, how- 
ever, non-trivial coin tossing is possible 0, 0, 0, 0, 0- 
In many applications, the parties do not want to gen- 
erate a sin gle coin, but many. This is called bit-string 
generation IllL Il2l | . Here we report on an experimen- 
tal implementation of bit-string generation based on the 
"plug and play" scheme developed for Quantum Key Dis- 
tribution (QKD) in optical fibers at telecommunication 
wavelengths Using the theoretical analysis of 

we are able to show that the bit strings generated in our 
experiment achieve a level of randomness impossible clas- 
sically. This is the first demonstration of a fundamental 
new concept: namely the possibility of generating ran- 
dom coins with an adversary who is limited only by the 
laws of physics. 

The present work focuses on bit string generation 
rather than the tossing of a single coin for two rea- 
sons. First it is shown in [l^ that in principle arbi- 
trarily high levels of randomness per bit can be obtained 
for bit stringgeneration whereas this is not the case for 
coin tossing[^0|. Hence bit string generation is more 
promising from the point of view of applications. Sec- 
ond, present experimental limitations (mainly detector 
noise and inefficiency) seem to preclude tossing a single 
coin with a level of randomness higher than what is pos- 
sible classicaly. This difficulty is illustrated by another 
experiment which recently realized some aspects of coin 
tossing |Q| , but for which it was impossible to prove that 



a level of randomness impossible classically was achieved. 

We begin by reviewing security conditions for the gen- 
eration of n random bits. The outcome of the protocol 
is either a string of bits x € {0, 1}" or one of the parties 
aborts, in which case we write x =_L. The protocol is 
correct if when both parties are honest, the probability 
of aborting is small and all the coins are fair. Mathemat- 
ically we express this as 



Vce{0,l}" V{x = c) 
P(x =_L) 



(l-'5«)/2". 



(1) 



It is necessary to include the parameter i5„ because of ex- 
perimental imperfections which induce a non-zero prob- 
ability of the protocol aborting even if both parties are 
honest. In the protocol we use (5„ decreases to zero ex- 
ponentially fast with n and can be neglected. 

We shall use two security conditions. The first, called 
the "average bias" , describes the degree of randomness 
of individual bits of the string. Formally we define the 
upper bound ^a(b) on the average bias when Alice (Bob) 
is dishonest and the other party is honest as: 

1 " 1 

V^aVc e {0, 1}" - V P'^-^^" {x, = c) < - + £7, 

n ^-^ 2 

i=l 

n ^ 

V^sVc £{0,1}" - V P^-*^- [x, = q) < - + e^, (2) 
n ^-^ 2 

i=i 

where we denote a general strategy of Alice (Bob) by Sa 
(Sb), and the honest strategy defined by the protocol as 
Ha (Hp ) . Classically, when (S„ = 0, one has + es > 
1/2 [l2|. (When (5„ 7^ the classical bound becomes 
eA + e^> l/2-25„.) 

The second security condition measures the degree of 
randomness of the string taken as a whole. We define 
Ha{b) as the entropy of the string if Ahce (Bob) is dis- 
honest and the other party is honest. In [l3|, bounds on 
the entropy are derived for our protocol assuming general 
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cheating. However the corresponding classical bound is 
not known, although it is conjectured in Il2l to be of the 
form Ha + Hb < n + o(n) . We refer to for a more 
detailed discussion of security conditions and for formal 
definitions of 

The protocol we shall use, inspired by that of 0, 0| 
is as follows. Choose a security parameter < k < 1. 

1. For i = 1 to n. 

2. Alice chooses a random bit a^. If = 0, she pre- 
pares a coherent state of the electromagnetic field 
with amplitude a: iI^q = \a). If = 1, she prepares 
a coherent state with amplitude —a: ipi = \ — a). 
She sends the coherent state ipat to Bob. After re- 
ceiving the quantum state from Alice, Bob chooses 
a random bit bi. Bob tells Alice the value of 6,;. 

3. After learning the value of bi, Alice reveals the value 
of a.i to Bob. 

4. Bob now verifies whether the state Alice sent him 
is indeed the coherent state |(— l)"'a). He does 
this by using a Local Oscillator (LO) to carry out 
the displacement !?(— (— l)°'a). If Alice was hon- 
est, the displaced state should be the vacuum state. 
Bob checks that this is the case by sending the state 
onto a single photon detector. If the detector clicks, 
Bob sets ki = 1. If the detector does not click, Bob 
sets ki = 0. 

5. Next i. 

6. If i J2i > '^i Bob aborts. Otherwise the output 
of the protocol is the bit string Xi = (ai+bi) mod 2. 

When Bob is dishonest his best strategy is to measure 
the state sent to him by Alice as soon as he receives it 
(i.e. , be fore carrying out step 3 above). One easily shows, 
see [13, that 

< where cosO = |(^o|V^i)| = fi-'l"!' . (3) 

If Alice is dishonest she may not send Bob the state ipai 
but an arbitrary state p. In general she may prepare an 
entangled state, keeping half of it and sending the other 
half to Bob. Furthermore, she may correlate and even 
entangle her strategy over different runs. In 0|, how- 
ever, it is shown that strategies correlated over different 
runs cannot help Alice for large n. A bound on Ta is 
proven that depends on the average value of the fidelity 
fi = (ipailpl'tpai) , as estimated by Bob. Since the proba- 
bility that Bob's detector clicks (assuming his detector is 
perfect) is related to the fidelity by P{ki = 1) > 1 — /i, 
the result of then implies that, assuming large n, the 
bias if Alice is dishonest is bounded by Fa < J-{k), where 

'^^^^ ^ ^2^^ e sin^ e ■ Below we show how this relation 



must be modified to take into account imperfections in 
Bob's measuring apparatus. 

Note that due to such imperfections, Bob's detector 
may click even if Alice is honest. Alice and Bob should 
choose K such that it is larger than the expected number 
of clicks if both parties are honest. When this is the case, 
the probability 5„ that the protocol aborts if both parties 
are honest decreases exponentially fast to zero and the 
protocol is correct. 

Our experimental setup, depicted in Fig. ^ is based 
on the plug and play system developed for long distance 
QKD [13 • The advantage of the plug and play system 
is that it constitutes an all-fiber (standard SMF-28), au- 
tomatically balanced interferometer, and hence is well 
suited to long distance quantum communication. How- 
ever the plug and play system has a number of specific 
features which must be carefully taken into account. 

Bob to Alice and Bob 's cheating. Each round of the 
protocol begins with Bob producing a short (20ns) in- 
tense (25mW) laser pulse at A = 1.55//m. The pulse is 
split in two by the 50/50 coupler Ci. The two pulses 
acquire a relative time delay of 100ns and then impinge 
with orthogonal polarization on a Polarizing Beam Split- 
ter (PBS) whereupon they are sent to Alice. Between 
Ci and the PBS, along the long path, are an attenuator, 
a 99/1 coupler C2 and a phase modulator. The role of 
these elements will be explained later. The relative at- 
tenuation of the two pulses is A ~ 45dB. The first pulse 
to reach Alice is intense and contains Nq ~ 10^ photons. 
This pulse will play the role of LO. The second pulse 
to reach Alice is attenuated and contains ANq photons. 
The second pulse will play the role of signal. 

Upon receiving the pulses, Alice measures the intensity 
of the signal pulse (using the 80/20 coupler C3 and a 
classical detector Dd) and attenuates both pulses. The 
two pulses are reflected by the Faraday mirror and travel 
back to Bob. The total attenuation at Alice's site is A' ~ 
50dB. Thus the two pulses now contain A'Nq and AA'Nq 
photons respectively. In particular the signal pulse now 
contains only a few photons {AA'Nq = |ap = 0(1)). 
Alice also adds a phase (f)A = Q-iTr to the signal pulse, 
thereby encoding the value of her bit . 

The fact that Bob provides Alice with the signal state 
seems to provide him with some simple cheating strate- 
gics. For instance he could provide Alice with a signal 
state that is squeezed in phase in order to decrease the 
overlap between \iPq) and iV'i)- This apparently allows 
him to discriminate much better j-^o) from and hence 
the value of a,. The role of the attenuation is to prevent 
this kind of cheating. Indeed under strong attenuation 
any quantum state tends towards a mixture of coherent 
states. 

To show this we describe the state by its generalized 
Wigner function W{q,p,s). We recall that W{s ~ — 1) 
is the Q function which is always positive, W{s = 0) is 
the Wigner function, and W{s = -1-1) is the P function. 
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If the P function is positive, then the state is a mixture 
of coherent states. Under attenuation by A we have (see 
113): W°^\q,p,s) = which im- 

phes that W°^*{s = \—2A) is positive. This expresses the 
fact that for A ^ one tends towards a positive P func- 
tion. This result can be made more quantitative by sup- 
posing that after attenuation we add a small amount of 
Gaussian noise with mean number of chaotic photons n. 
This affects the Thus attenuation followed by addition of 
chaotic photons yields the transformation W°^'^{q,p, s) = 
"-^"+-^-1 ) and in particular if n = A we 

have W''"\q,p,s = +1) = = -1), i.e. 

the output P function is positive since it is given in terms 
of the input Q function. Thus after strong attenuation, 
say A = 10^^, a quantum state is very well approximated 
by a mixture of coherent states since a very small amount 
of Gaussian noise with mean number of chaotic photons 
n ~ 10^'^ transforms the state into a mixture of coherent 
states. 

Another simple cheating strategy is for Bob to increase 
the intensity of the signal state since it is then much 
easier for him to estimate the phase (j)A- The role of 
the classical intensity measurement is to ensure that the 
signal state Alice sends back is not too intense. In fact it 
is impossible for Bob to exploit the fact that he provides 
Alice with the light pulse which will become the signal 
state, since by measuring the intensity of the pulse Bob 
sends her and then attenuating it, Alice ensures that she 
sends back to Bob a coherent state of known intensity. 

Note that the classical intensity measurement of Alice 
will be affected by noise because ANq is close to the sensi- 
tivity limit of Alice's detector. We circumvent this tech- 
nical problem by letting Alice carry out statistical tests 
on the n intensity measurements (one for each round of 
the protocol). More precisely she checks whether the 
distribution of measured intensities is consistent with 
the Gaussian distribution she expects from instrumen- 
tal noise. If it is she has a precise estimate of jap, and 
hence of es through eq. If it is not she aborts. 

From Alice to Bob and Alice's cheating. Upon receiv- 
ing the two pulses from Alice, Bob uses coupler C2 to 
measure the intensity of the LO, attenuates it by A, and 
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FIG. 2: Optical setup equivalent to Bob's measurement, in- 
cluding its imperfections. 



adds a phase e"^^ , with <j>B — ajTr. Note that by measur- 
ing the intensity of the LO state provided by Alice and 
then attenuating it. Bob ensures that the LO he uses is a 
coherent state (or a mixture of coherent states) of known 
intensity (The argument is exactly the same as that 
given above in the case of Alice). 

Let us consider the two states that interfere at coupler 
Ci. On the one hand there is the LO which as we have 
just argued is a coherent state of known intensity 
On the other hand there is the signal state. The signal 
state travels through the PBS where it gets attenuated 
by ^0- It then interferes with the LO at coupler Ci. 
This coupler has transmission and reflection coefficients 
T and R (both are approximately 50%). Finally one of 
the outputs of the coupler is sent to a single photon detec- 
tor (id Quantique) with efSciency rj. In our experiment 
AqT = 4.3dB and 77 = 10.5%. We can therefore model 
the whole of Bob's detection system by the scheme de- 
picted in Fig. 121 It is composed of the LO (a coherent 
state of amplitude (3), the signal state the attenuator 
Aq, a beam splitter with transmission and reflection co- 
efflcients T and R. The imperfect detector is modeled by 
an attenuation of rj followed by a perfect detector. 

Let us denote by a the amplitude of the coherent state 
that would give rise to destructive interference at the 
single photon detector. It satisfles a^/AoT + iP^/R = 
0. When = 0, the state Alice should send if she is 
honest is the coherent state |a). (If ai = 1 she should 
send the state \ — a). By using the phase modulator 
Bob can cancel this phase). But if Alice is dishonest she 
will send another state 1^*). We expand j^*) in the basis 
of displaced Fock states j^*) = Da{ct)J2n'^n\n') where 
Da{a) is the displacement operator acting on mode a, ie. 
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Da{a)aDa{a)^ = a — a. and \n) = (a^)"/VnI|0) are the 
Fock states. The fidehty of the state sent by Ahce is thus 
/ = |(a|*)p = |cop. 

We model the effeet of the attenuation by the trans- 
formation a y/A^a' + \/l — AqCi where ei is a mode 
of the environment; the effect of the BS by the transfor- 
mations a' —> Vrd' — i^/Rc, b — > \/Tc — i^/Rd'; and the 
effeet of the detector inefficiency by d' y/rjd+\/l — 7762 
where 62 is another mode of the environment (the modes 
a,a' ,b, c,d' , d are all described in the figure). One then 
finds that the state just before entering the single pho- 
ton detector is Dc{j) Y.n '^W^oT^d^ + WAqRc^ + 

VI - Aoe\ + -??)ryloe^]"|0) where 7 = pVT + 
ia\/AQR. From this one easily computes that the proba- 
bility that the detector does not register a single click is 

00 

P{no click) = J2 - ^0^7])". (4) 

The probability of registering a click is thus bounded by 
P{click) > (1 — |coP)AoT?7. Thus the number of chcks 
on Bob's detector divided by AoTrj gives a bound on the 
fidelity \co\\ 

A final inefficiency that must be taken into account is 
that Bob's detector will have a non-zero dark count rate 
Hdark = 9 10^"^. Putting all this together we deduce the 
bound on the average bias if Alice is dishonest: 

A0T77 

Note that this bound on Ta is given entirely by parame- 
ters which can be measured by Bob. 

Using this protocol, and taking into account experi- 
mental imperfections as described below, a typical run of 
our experiment generates 10^ coins. Some results for dif- 
ferent values of |ap are presented in Fig.|31 For instance 
when = 0.03, we obtained + ee = 0.32 ± 0.04, 
which is significantly better than the classical bound 
eA + e^> 1/2. 

An important property of this protocol and of its ex- 
perimental implementation is that we do not have to 
make any hypothesis about the Hilbert space Alice or 
Bob use if they are dishonest -for instance it is not nec- 
essary to restrict them to the single photon subspace-, 
nor do we have to make any hypothesis about the kind 
of technology they can use if they are dishonest. Thus 
the randomness of the bit string when one of the parties 
is dishonest is guaranteed by the laws of physics. 
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FIG. 3: Measured bounds on average bias and on entropy of 
bit strings for different values of the average photon number 
. Open squares: bounds on obtained using eq. open 
circles: bounds on TX obtained using eq. I^: filled squares: 
bounds on Fa -f es". Classically the sum is always greater 
than 1/2. The bit strings are clearly more random than is 
allowed by the best classical protocol. The same expressions 
which give bounds on eX, es" also give lower bounds on the 
entropies Ha{b) of the bit string if Alice (Bob) is dishonest 
(see [131 )■ Filled triangles: bounds on the entropy per bit 
{Ha + HB)/n. It is conjectured in [13 that for any classical 
protocol {Ha + HB)/n is bounded by 1 for large n. The 
experimental points are clearly above this bound. The error 
bars for Ta+Tb and {Ha + Hb)/^^ describe systematic errors 
arising from incorrect callibration of detector efficiency 77 and 
incorrect estimation of o? . The plotted curves are theoretical 
predictions based on the observed optical visibility of 96.5%. 
For Tb the curve is given by eq. J^J and for Ta it is given by 
eq. using the fact that for small a^, {k — Hdark) /AoTrj ~ 
{l-V)a^/2. 
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